mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
d5ee0b1699
* feat(secrets): stop deploying the retired OpenPGP key * chore(flake): bump mysecrets past the move to legacy/ Assisted-by: DeepSeek Harness (claude-opus-5-5)
76 lines
1.9 KiB
Nix
76 lines
1.9 KiB
Nix
{
|
|
pkgs,
|
|
agenix,
|
|
mysecrets,
|
|
myvars,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
agenix.darwinModules.default
|
|
];
|
|
|
|
# enable logs for debugging
|
|
launchd.daemons."activate-agenix".serviceConfig = {
|
|
StandardErrorPath = "/Library/Logs/org.nixos.activate-agenix.stderr.log";
|
|
StandardOutPath = "/Library/Logs/org.nixos.activate-agenix.stdout.log";
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
agenix.packages."${pkgs.stdenv.hostPlatform.system}".default
|
|
];
|
|
|
|
# if you changed this key, you need to regenerate all encrypt files from the decrypt contents!
|
|
age.identityPaths = [
|
|
# Generate manually via `sudo ssh-keygen -A`
|
|
"/etc/ssh/ssh_host_ed25519_key" # macOS, using the host key for decryption
|
|
];
|
|
|
|
age.secrets =
|
|
let
|
|
high_security = {
|
|
mode = "0500";
|
|
owner = "root";
|
|
};
|
|
user_readable = {
|
|
mode = "0500";
|
|
owner = myvars.username;
|
|
};
|
|
in
|
|
{
|
|
# ---------------------------------------------
|
|
# only root can read this file.
|
|
# ---------------------------------------------
|
|
|
|
"rclone.conf" = {
|
|
file = "${mysecrets}/desktop/rclone.conf.age";
|
|
path = "/etc/agenix/rclone.conf";
|
|
}
|
|
// high_security;
|
|
|
|
"nix-access-tokens" = {
|
|
file = "${mysecrets}/server/nix-access-tokens.age";
|
|
}
|
|
# access-token needs to be readable by the user running the `nix` command
|
|
// user_readable;
|
|
|
|
# ---------------------------------------------
|
|
# user can read this file.
|
|
# ---------------------------------------------
|
|
|
|
"ssh-key-romantic" = {
|
|
file = "${mysecrets}/desktop/ssh-key-romantic.age";
|
|
path = "/etc/agenix/ssh-key-romantic";
|
|
}
|
|
// user_readable;
|
|
|
|
# work git identity, symlinked to ~/work/.gitconfig by home-manager
|
|
"work-gitconfig" = {
|
|
file = "${mysecrets}/desktop/work-gitconfig.age";
|
|
path = "/etc/agenix/work-gitconfig";
|
|
}
|
|
// user_readable;
|
|
};
|
|
|
|
}
|